atoship vs ShipStation API

atoship 30

Graded as a hosted service on the MCP server at atoship.com/api/mcp and REST API v1. status.atoship.com serves the marketing home page and the docs' API Status page rendered no status content, so no status page is counted (0). No readable incident history (5). 429 and a RATE_LIMIT_EXCEEDED code are documented, without numbers (5 of 15). A 429 carries error.retryAfter and Retry-After; no idempotency key for label purchases was found (10 of 15). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

ShipStation API 70

Graded on ShipStation API v2 at api.shipstation.com/v2, with the hosted lines. Statuspage at status.shipstation.com with components for Companion API V1 and V2, carriers and marketplaces (20). The history pages and feed, read on 4 November, list 13 incidents and one scheduled maintenance between 6 August and 4 November. The four labelled major each touch one or two carriers (DPD Local and DX on 11 September, Evri on 24 and 25 September, DPD on 20 October, Evri shipments to the EU on 29 and 30 October), and the rest are minor or notices, so all are partial and read as minor (20). 200 requests a minute by default, per the 7 October check, not re-read on 4 November (15). 429 responses carry Retry-After and the docs ask for retries handled globally, with no idempotency key or safe-retry guidance for label purchases, per the 7 October check, not re-read on 4 November (10). No SLA found (0). The getting-started page says v2 "is currently in an early release stage" while calling it tested and stable, per the 7 October check, not re-read on 4 November (5).

atoship 55

No OpenAPI found (/openapi.json is 404); a Postman collection v2.1 of 15 endpoints is the only machine-readable contract, and the hosted MCP tools' schemas were not read because /api/ is disallowed (15 of 25). llms.txt (10). The MCP page gives each tool a one-line description and an example prompt (8 of 20). Input typing could not be checked beyond the docs' object pages (5 of 15). The errors page documents status codes, error.code values and retryAfter, with examples (12 of 15). v1 API, no changelog found (5 of 15). 15 + 10 + 8 + 5 + 12 + 5 = 55.

ShipStation API 83

OpenAPI 3.1 for v2 at docs.shipstation.com/_bundle/apis/@shipstation-v2/openapi.yaml, 173 operations on 123 paths and 372 schemas (25). llms.txt with 480 lines of links and a Markdown copy of each docs page (10). Guides explain when to use rates against estimates and webhooks against polling. Operation descriptions in the spec are one line each (13). 152 enums, required fields and read-only markers, though carrier and service codes are free strings that depend on the account (12). 1,648 example entries and enumerated error_code and error_type values. The spec documents 400, 404 and 500 but no 401 or 429 response (11). Release notes are dated by month and the spec version has stayed 2.0.0 through every addition (12). Docs, pricing and legal pages per the 7 October check, not re-read on 4 November.

atoship 55

Live and test API keys sent as Bearer tokens, with the docs advising separate keys with limited scopes and rotation, and OAuth with PKCE for the hosted MCP server (25 of 30). Test keys create no real labels, the consent screen names label buying and voiding, and the docs say the agent can spend only funds already in the wallet, with no per-call confirmation (12 of 20). Responses carry addresses and carrier tracking data rather than free text from strangers (10). No audit log found (0). security.txt valid to December 2027 with a security contact; no certification, bounty or disclosure policy beyond the terms (8 of 20). 25 + 12 + 10 + 0 + 8 = 55.

ShipStation API 32

One secret in an API-Key header. The docs say the key gives full access. Platform accounts hold one active v2 key that can be regenerated, and ShipStation API accounts have separate TEST_ sandbox keys (17). No scopes, read-only keys or confirmation before a label purchase. The sandbox key is the only lower-risk mode (5). Responses carry order text, addresses and carrier messages written by others, with no injection guidance (3). A request_id on every response. No per-key audit log found in the docs (3). TLS 1.2 or higher required, HSTS on the API host and RSA-SHA256 signed webhooks with a JWKS. security.txt returns 404 on three hosts, and no certification, bug bounty or disclosure policy was found on the pages we read (4). Docs, pricing and legal pages per the 7 October check, not re-read on 4 November.

atoship 10

No changelog or release notes found. The newest dated release is @atoship/mcp 1.0.2 on 18 February 2026, more than 180 days ago (0). No dated releases in the 90 days from 8 August (0). Support by email, with no public tracker; the repository named on npm is not public (5 of 15). The MCP package is official, and only the Go SDK of eight listed is installable (5 of 15). No public CI (0). 0 + 0 + 5 + 5 + 0 = 10.

ShipStation API 33

Release notes on docs.shipstation.com are dated by month only, with entries for August, September and October 2026 on the 7 October reading, so they don't set recency. The newest dated change from ShipStation's own sources is the shipengine-openapi repository commit of 11 June 2026, after .NET SDK v3.2.1 on 27 May and Python 2.1.1 on 6 May (146 days, 10). No dated release in the 90 days from 6 August. Month-dated entries counted at half come to fewer than three, and commits on 27 October in the JavaScript and .NET SDK repositories are in no release (0). Closed service with monthly release notes, an API support address (apisupport@shipstation.com) and a community forum. We couldn't measure reply times (10). Official SDKs exist in six languages, and all call the v1 ShipEngine host. JavaScript's newest tag is v1.0.7 of 31 January 2024 (8). SDK repositories have CI workflows, and the JavaScript SDK's CI was rebuilt on 27 October. The OpenAPI repository was last changed on 11 June 2026 (5).

atoship 45

Closed service under terms naming atoship LLC of California (15 of 30). The privacy policy (7 May 2026) keeps data as long as necessary with no periods and names no processors (10 of 30). No deprecation policy or dated notices found (0). No subprocessor list or data locations found (0). 15 + 10 + 0 + 0 = 25.

ShipStation API 64

Closed service under terms of service effective 16 July 2026 that name Auctane LLC d/b/a ShipStation. The v2 OpenAPI file is marked MIT and the SDKs are Apache 2.0 (16). The privacy policy, effective 18 March 2026, is Auctane, Inc.'s for all its brands. It keeps data "as long as necessary" with no periods, and says third parties may not train AI models on personal information. No public DPA was found (12). The legacy V1 API is described as deprecated with removal "in the future" and no date, and the terms let ShipStation withdraw API access at its discretion (6). US persons' data stays in the United States and EEA and UK data may move there under the Data Privacy Framework. Service providers are named by type, with no subprocessor list (8). Docs, pricing and legal pages per the 7 October check, not re-read on 4 November.

atoship 53

12 MCP tools (15, for 11 to 30). List tools for orders and labels, with paging not documented in the pages read (8 of 20). Machine-readable error codes with a retry delay (18 of 20). The npm package's tools carry no readOnlyHint or destructiveHint, and no idempotency key was found; void_label undoes a mistaken purchase (5 of 20). Only the Go SDK installs, the hosted server is one URL, and test keys give a safe default (7 of 15). 15 + 8 + 18 + 5 + 7 = 53.

ShipStation API 64

No MCP server that performs shipping operations. The MCP server at docs.shipstation.com/mcp reads documentation only. List endpoints take page_size. No field selection was found (12). page, page_size, sort_by, sort_dir and filters by status, tag, dates, store and external id on list calls (20). Errors carry error_source, error_type, error_code, message, field names and a request_id (18). No idempotency keys. external_shipment_id is unique per shipment, labels can be voided and test_label exists, which we counted as partial safe-retry support (6). Official SDKs in six languages call api.shipengine.com/v1, not v2, and a label needs a carrier_id and service_code looked up first (8). Docs, pricing and legal pages per the 7 October check, not re-read on 4 November.